# Tag Info

16

You have clarified the question as asking about whether replacing ShiftRows with a random byte permutation would strengthen AES against differential attacks. It would not. ShiftRows and MixColumns were carefully selected to work in tandem, such that every byte affects every other byte in the state within just two rounds. MixColumns ensures that every ...

9

I assume that you mean the S-box. The answer is NO! Randomly chosen S-boxes are not good choices for differential and linear cryptanalysis. When Biham and Shamir presented differential attacks on DES, one of the things that they showed was that if you replace the S-boxes in DES with randomly chosen ones, then the differential attack becomes much more ...

5

The difference distribution table for the AES s-box contains mostly probability 2/256 differentials. However, there is a single probability 4/256 for each input/output difference. I uploaded a dump of the table here so that you can see. The code used to produce this table can be found here. Disclaimer: This is my personal github. If by "uniform", you mean ...

4

Remark: The round function of your toy cipher is the following. | K ---> + | ------- | S | ------- | >> 2 | Hence in the last round, the shift and S-box are useless (because invertible hence do not add security) which is why in a SPN scheme the key addition at the end is preferred. I did a ...

4

The function $f$ is biased towards the complement of the input $c_{i,j}$, assuming the other two inputs are approximately randomly distributed. As all the values $c_{i,j}$ are public, this means that the output of the function $R_i$, and hence the function $F$ is strongly distinguishable from random (being biased towards a known bit pattern). This isn't an ...

4

In the case of block ciphers, differential cryptanalysis aim to measure the changes between inputs and outputs with a probability. The goal is to predict what the result will be before the last round and try to extract the key. For hash functions, your aim is to find a second-pre-image. I will take Keccak as an example. It is a sponge construction ...

3

Those tables are fairly easy to build conceptually but require quite some work to actually carry out. Note that: The columns show the XOR for the in-going pairs and the rows show the number of pairs that had the specified XOR afterwards. This pseudo-code generates the table: InLength; // input length of the S-Box in bits OutLengh; // output length of the ...

3

Usually differential cryptanalysis relies on something called the "wrong key randomization hypothesis", which is the assumption that decryption of the last round with the wrong key results in a random difference at the beginning of the last round, while decryption with the correct key will result in the expected difference with the probability of the ...

3

Anyone who begins to develop an attack on primitive XYZ is probably not aware beforehand of what the computational complexity of their attack will turn out to be. Then, the attack is developed and computational complexity becomes known. Just because DES isn't broken by the attack in question does not mean no other ciphers will be. And just because the ...

3

Differential cryptanalysis is a very powerful technique that permitted highly practical attacks on many ciphers that were not designed to resist it (e.g. FEAL-4). DES, as it turns out, was designed to be pretty resistant to it, which is why it requires an essentially impractical amount of chosen plaintexts to implement a differential attack on DES. ...

2

This is the code i used to simulate your Sbox (no intelligence, pure application with lots of mask for security). virtual uint8 apply_s(uint16 input, int numBits) { uint16 mask = 1; for (int i = 1; i < numBits; ++i) { mask |= mask << 1; } uint32 res = input & mask; res = res * res; res = (res >> ...

2

The key does not effect the cipher' differentials threw the equation (x+k)+(x'+k)=x+x' (the + sign means xor) How you can yes the key is X1+k=x2 And threw the xor k=X1 +x2 X1 is the value beffor the xor with the key value k. X2 is the output of X1+k To make this attack work beffor you must find a differential for the two input pairs threw a chosen ...

1

AES S-box DDT is not uniform but it has a higher resistant to differential attacks than DES because of maximum probablity of input output pair of differential is 4/256.

Only top voted, non community-wiki answers of a minimum length are eligible